Easy Post Submission
Easy Post Submission allows users to submit posts from frontend forms.
Easy Post Submission (easy-post-submission) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 9.1.
easy-post-submissionCVE-2026-4431: Easy Post Submission postId updates permit unauthenticated post tampering
Easy Post Submission through 2.3.0 exposes rbsm_submit_post through wp_ajax_nopriv_rbsm_submit_post. When an unauthenticated caller supplies postId, create_post() does not verify that the caller may edit the selected post. The attacker can overwrite arbitrary posts' titles, content, excerpts, categories and tags, or change the status to draft and effectively unpublish them. The CNA does not disclose the remaining field names or the lower-level post-update function.
| Safe version |
|
||
|---|---|---|---|
| Aug 05, 2026 |
CVE-2026-4431
Easy Post Submission postId updates permit unauthenticated post tampering
Easy Post Submission through 2.3.0 exposes rbsm_submit_post through wp_ajax_nopriv_rbsm_submit_post. When an unauthenticated caller supplies postId, create_post() does not verify that the caller may edit the selected post. The attacker can overwrite arbitrary posts' titles, content, excerpts, categories and tags, or change the status to draft and effectively unpublish them. The CNA does not disclose the remaining field names or the lower-level post-update function.
|
> 2.3.0 |
CVE9.1
NVDPending
|
| Mar 05, 2026 |
CVE-2026-22479
Easy Post Submission: A security weakness
Easy Post Submission is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Oct 22, 2025 |
CVE-2025-62062
Easy Post Submission: A security weakness
Easy Post Submission is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE5.5
NVDPending
|